security-improved: user can not update client-side over and over again